GlusterFS - Port 24007, 24008, 24009, 49152

Basic info

What is GlusterFS?

GlusterFS is a distributed file system that provides:

  • Scale-out storage - Add servers to expand capacity

  • No metadata servers - Elastic hashing algorithm

  • POSIX compatibility - Standard file system interface

  • High availability - Replication and self-healing

  • Multiple protocols - Native client, NFS, SMB

  • Flexible volumes - Distributed, replicated, striped

Architecture

Key Components:

1. Glusterd (Management Daemon)

  • Port 24007 (default)

  • Peer management

  • Volume configuration

  • RPC-based protocol

2. Brick

  • Basic unit of storage

  • Directory on a server

  • Starts at port 49152 (incremental)

  • One port per brick

3. Volume

  • Logical collection of bricks

  • Various types (distributed, replicated, striped)

  • Mounted by clients

4. Client

  • FUSE native mount

  • libgfapi (application integration)

  • NFS/SMB gateway

Volume Types

1. Distributed Volume

2. Replicated Volume

3. Striped Volume

4. Distributed-Replicated

Port Allocation

Fixed Ports:

  • 24007 - glusterd management daemon

  • 24008 - glusterd management (legacy, < v9)

  • 24009 - glusterd management (legacy, < v9)

Dynamic Ports:

  • 49152+ - Brick processes (incremental)

    • First brick: 49152

    • Second brick: 49153

    • Third brick: 49154

    • etc.

Common Use Cases

Real-World Deployments:

  • Wikimedia - Media storage

  • KVM - Virtual machine images

  • OpenStack - Cloud storage backend

  • Red Hat - OpenShift persistent storage

  • Media Companies - Video rendering farms

Application Scenarios:

  • Object storage

  • Big data analytics

  • Media streaming

  • Backup storage

  • Container persistent volumes

  • Home directories (NFS replacement)

Default Ports

Primary: 24007, 24008, 24009, 49152-49162 (typical)

Reconnaissance & Enumeration

Port Scanning

Basic Nmap Scan

Sample Output:

Service Fingerprinting

Check if glusterd is running:

Install GlusterFS Client

Debian/Ubuntu:

RHEL/CentOS:

Verify Installation:

Shodan Queries

Authentication Testing

No Authentication by Default

Critical Security Issue:

GlusterFS by default has NO AUTHENTICATION. Anyone who can connect to port 24007 can:

  • List all peers

  • Query volume information

  • Mount volumes (if not restricted)

  • Potentially modify cluster configuration

Test Unauthenticated Access

Volume Enumeration

List All Volumes

Cluster Information

Get Cluster Status

Volume Mounting & Data Access

Mount Volume (No Authentication)

Basic Mount:

Successful Mount = Full File System Access

Access Control Bypass

If mount fails with permission error:

TLS Certificate Theft

If TLS is enabled:

Data Exfiltration

Once Mounted:

Exploitation & Known Vulnerabilities

CVE-2023-3775: Unauthorized Mount (Privilege Escalation)

Affected: GlusterFS < 10.5 / 11.1

Vulnerability: Incorrect permission validation allows unauthenticated mounting of gluster_shared_storage admin volume.

Impact: Privilege escalation to root on all cluster nodes.

Exploitation:

Alternative Locations:

CVE-2022-48340: Use-After-Free (RCE)

Affected: GlusterFS 10.0-10.4, 11.0

Vulnerability: Use-after-free in dht_setxattr_mds_cbk function.

Impact: Remote DoS and probable RCE.

Exploitation: (Requires deep protocol knowledge)

CVE-2023-26253: Out-of-Bounds Read (DoS)

Affected: GlusterFS < 11.0

Vulnerability: Out-of-bounds read in FUSE notify handler.

Impact: Remote crash (DoS).

Exploitation:

Result: glusterfsd process crashes, disrupting storage cluster.

Directory Traversal

If application uses GlusterFS for file storage:

Post-Exploitation

Data Manipulation

Once Mounted with Write Access:

Persistence via Hooks

Malicious Hook Scripts:

Information Gathering

Extract Cluster Topology:

Harvest Credentials from Volumes:

Defense & Hardening

Enable TLS/SSL

Configure Transport Encryption:

Access Control

IP-Based Restrictions:

User Authentication (Experimental):

Network Security

Firewall Rules:

Private Network Only:

Secure Shared Storage

Protect gluster_shared_storage:

Monitoring & Detection

Enable Audit Logging:

Monitor glusterd Logs:

Network Monitoring:

Intrusion Detection Rules:

Regular Security Practices

Update & Patch

Tools & Scripts

Essential Tools

  1. gluster CLI - Management commands

  2. mount.glusterfs - Volume mounting

  3. nmap - Discovery

  4. Custom Python scripts - Automation

Custom Enumeration Script

Cheat Sheet

Quick Reference

Important Ports

Critical Files

Additional Resources

circle-check

Last updated